Infusion Pumps Total Product Life Cycle
Guidance for Industry and FDA Staff
Document issued on: December 2, 2014.
The draft of this document was issued on April 23, 2010.
This document supersedes the “Guidance on the Content of Premarket Notification [510(k)] Submissions for External Infusion Pumps,” issued March, 1993.
For questions regarding this document, please contact Alan Stevens, General Hospital Devices Branch, Office of Device Evaluation at 301-796-6294 or via email at [email protected].
For questions regarding safety assurance cases, please contact Richard Chapman, General Hospital Devices Branch, Office of Device Evaluation at 301-796-2585 or via email at [email protected].
For questions regarding pre-clearance inspections, please contact Francisco Vicenty, Respiratory, Ear/Nose/Throat, General Hospital, Infectious Control, and Ophthalmic Devices Branch, Office of Compliance at 301-796-5770 or via email at [email protected].
For questions pertaining to manufacturer reporting requirements, please contact Sharon Kapsch at 301-796-6104 or via email at [email protected].
U.S. Department of Health and Human Services Food and Drug Administration Center for Devices and Radiological Health
Office of Device Evaluation Division of Anesthesiology, General Hospital, Respiratory, Infection Control, and Dental Devices General Hospital Devices Branch
Contains Nonbinding Recommendations
Preface
Public Comment You may submit electronic comments and suggestions at any time for Agency consideration to http://www.regulations.gov. Submit written comments to the Division of Dockets Management, Food and Drug Administration, 5630 Fishers Lane, Room 1061, (HFA-305), Rockville, MD, 20852. Identify all comments with the docket number FDA-2010-D-0194. Comments may not be acted upon by the Agency until the document is next revised or updated.
Additional Copies Additional copies are available from the Internet. You may also send an e-mail request to CDRH- [email protected] to receive a copy of the guidance. Please use the document number 1694 to identify the guidance you are requesting.
2 Contains Nonbinding Recommendations
Table of Contents 1. INTRODUCTION ...... 4 2. BACKGROUND ...... 5 3. SCOPE ...... 5 4. DEVICE DESCRIPTION ...... 6 5. SAFETY ASSURANCE CASE...... 9 A. GENERAL CONSIDERATIONS FOR SAFETY CASE DEVELOPMENT...... 10 B. HAZARD ANALYSIS ...... 12 C. PERFORMANCE TESTING ...... 17 D. LABELING ...... 29 E. ALARMS ...... 32 F. SAFETY CONTROL MECHANISMS...... 32 6. 510(K) PRE-CLEARANCE INSPECTION OF INFUSION PUMP MANUFACTURERS ...... 33 7. POSTMARKET SURVEILLANCE OF INFUSION PUMPS ...... 34
3
Infusion Pumps Total Product Life Cycle
Guidance for Industry and FDA Staff
This guidance represents the Food and Drug Administration’s (FDA's) current thinking on this topic. It does not create or confer any rights for or on any person and does not operate to bind FDA or the public. You can use an alternative approach if the approach satisfies the requirements of the applicable statutes and regulations. If you want to discuss an alternative approach, contact the FDA staff responsible for implementing this guidance. If you cannot identify the appropriate FDA staff, call the appropriate number listed on the title page of this guidance.
1. Introduction The Food and Drug Administration (FDA) has developed this guidance document to assist industry in preparing premarket submissions for infusion pumps and to identify device features that manufacturers should address throughout the total product life cycle. Infusion pumps, as described in 21 CFR 880.5725, are intended for use in a health care facility to pump fluids1 into a patient in a controlled manner.2
The recommendations in this guidance are intended to improve the quality of infusion pumps in order to reduce the number of recalls and adverse events associated with their use. The FDA believes that these recommendations will help mitigate current risk and reduce future risk associated with infusion pumps.
FDA’s guidance documents, including this guidance, do not establish legally enforceable responsibilities. Instead, guidances describe the Agency’s current thinking on a topic and should be viewed only as recommendations, unless specific regulatory or statutory requirements are cited. The use of the word “should” in Agency guidances means that something is suggested or recommended, but not required.
1 For purposes of this guidance, the term “fluids” refers to FDA approved drugs and licensed biological products. 2 This guidance also includes recommendations for prescription infusion pumps intended for use by lay users in the home or elsewhere. For purposes of this guidance, “lay users” or “home users” are users who receive infusion pumps from or on the order of a health care provider and who use the pumps under the supervision of a licensed practitioner in any setting outside a healthcare facility, including the home.
4
2. Background The FDA has evaluated a broad spectrum of infusion pumps across manufacturers and has encountered problems with device software, human factors, reliability and manufacturing. Based on an evaluation of reported adverse events and recalls, FDA believes that many injuries and adverse events may be avoided by improving the design verification and validation processes for these devices. The most frequently reported infusion pump device problems are: software error messages, human factors (e.g., use error related to instructions for use, training, and other user interface issues), broken components, battery failure, alarm failure, and over infusion and under infusion. In some reports, the manufacturer was unable to determine or identify the problem and reported the problem as “unknown.” Subsequent analyses revealed that many of these were related to design problems that could be corrected during the design processes. This guidance is intended to improve the quality of infusion pumps and thereby reduce the incidence of these problems.
3. Scope The scope of this document is limited to class II devices classified under the regulation, 21 CFR 880.5725, which includes devices with the product codes listed in Table 1. The product codes listed are those that currently fall within the scope of 21 CFR 880.5725. Devices classified with future product codes created under 21 CFR 880.5725 following publication of this guidance are within the scope of this guidance document.
Note that infusion pumps submitted as part of a class III system are subject to the premarket approval application (PMA) pathway. While this guidance may provide valuable information regarding the elements to consider for a pump submitted as part of a PMA, such as hazard identification and sources of hazardous situations, not all items addressed in this guidance and recommended for a 510(k) submission would be relevant to a PMA submission. In addition, additional items may be required for a PMA that would not be required as part of a 510(k) submission.
§ 880.5725 Infusion pump (a) Identification. An infusion pump is a device used in a health care facility to pump fluids into a patient in a controlled manner. The device may use a piston pump, a roller pump, or a peristaltic pump and may be powered electrically or mechanically. The device may also operate using a constant force to propel the fluid through a narrow tube which determines the flow rate. The device may include means to detect a fault condition, such as air in, or blockage of, the infusion line and to activate an alarm. (b) Classification. Class II (performance standards).
Table 1 Product code Description FRN Infusion pump MEA Patient controlled analgesia (PCA) infusion pump MEB Elastomeric infusion pump LZG Insulin infusion pump OPP Insulin bolus infusion pump LZH Enteral infusion pump
5
MRZ Infusion pump accessories PHC Infusion Safety Management Software
For purposes of this guidance document, FDA defines the infusion pump system to include the:
• Infusion pump; • Fluid infusion set for the complete fluid pathway from, and including, the drug reservoir or fluid source container (e.g., bag, cassette, vial, syringe), infusion set, extension sets, filters and valves, clamps, up to and including the patient connection; • Components and accessories (e.g., power cord, wireless controller); • Network (i.e., any device or system physically or wirelessly connected to the infusion pump); • Patient; • Environment of use (e.g., clinical setting, temperature, humidity); and • User (e.g., health care provider, lay user, biomedical technicians).
If you intend to provide or recommend particular disposable functional devices for use with your infusion pump, such as infusion sets or cassettes, whether manufactured by you or another firm, you should identify these devices and whether they are legally marketed. Please note that for purposes of this guidance document, FDA considers such disposable devices to be part of the infusion pump system. Your device should be evaluated as a system, and the focus of the evaluation is on your product and its performance within the context of the infusion pump system.
In some instances, an infusion pump in conjunction with the fluid it delivers may be considered a combination product. See 21 CFR 3.2(e). If marketed as a combination product, additional regulatory requirements may need to be addressed for the combination product. For additional information about combination products, please contact the Office of Combination Products (OCP) at [email protected], or see the OCP webpage at http://www.fda.gov/combinationproducts/default.htm.
4. Device Description We recommend that you identify your device by the regulation and product code described in Section 3. Scope. In your 510(k) submission, you must provide a statement indicating your device is similar to and/or different from other products of comparable type in commercial distribution, accompanied by data to support the statement, as required by 21 CFR 807.87(f). Side by side comparisons, whenever possible, are desirable.
In addition to providing the information required in a premarket notification submission under 21 CFR 807.87, you should include the following descriptive information about your device:
• A clear statement of the indications for use. The indications for use should address: o the intended use environment; o the intended route(s) of administration for infusion; o any specific uses for the infusion pump (e.g., PCA is a generally accepted specific use); and o the indicated treatment population.
6
• FDA recommends that submissions include the documents that result from the design input and output processes that define the device (i.e., functional, performance, and interface characteristics) in engineering terms.3 There may be several such documents, covering the major hardware and software components of the system.
• Provide a detailed description (including, where appropriate, assembly drawings, bill of materials, schematics, and/or specification control documents) of the pump and its functional components and accessories, including:
o The infusion delivery mechanism; o The bolus mechanism; o The drug reservoir; o Pump tubing and connectors (built-in or external to the pump); o A user-interface, consisting of the programming unit, display unit, audio and tactile notification units; o Power supply; o Pump battery and circuitry to charge and monitor the battery; and o A communication interface, including network components and interfaces to other devices and systems.
• You should describe the principle of operation of the infusion pump (i.e., the scientific principles behind how the device achieves its intended use).
• If the infusion pump is labeled for use with a specific device, drug, or biologic, the labeling of the products should be consistent and you should provide the FDA approved labeling for that referenced device, drug, or biologic.4
• For each route of administration identified in your statement of intended use, you should identify a legally marketed drug or biologic to demonstrate that at least one such product is approved or licensed for infusion through the pump for the proposed route of administration and at the proposed dosage. You should provide the FDA approved labeling identifying the proposed route of administration for the identified drug or biologic.
• If your infusion pump is intended for transport or ambulatory use, you should describe how it is designed for mobility, various environmental conditions (e.g., water exposure, altitude, electromagnetic interference), and ruggedness.
• If your infusion pump is intended for lay use, you should describe how the device has been designed to be used by the lay user population, which often has limited or no clinical background, and how you have mitigated hazards arising from lay use. It is recommended that you reference the FDA’s Guidance on Medical Device Patient Labeling (http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/uc m070782.htm). FDA has issued a draft guidance on this topic, Draft Guidance for Industry and Food and Drug Administration Staff - Applying Human Factors and Usability
3 Your firm may refer to these documents as “system specifications,” “design requirements,” “requirements specifications,” or by other similar names. 4 FDA will consider whether the infusion pump and the specified drug or biological product constitute a combination product, as defined in 21 CFR 3.2(e).
7
Engineering to Optimize Medical Device Design (http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/uc m259748.htm). When finalized, this guidance will represent FDA’s current thinking on this topic.
• You should state if your device is capable of being remotely controlled from a distance and describe the measures incorporated to address hazards.
• If your infusion pump incorporates or is intended to incorporate radio-frequency (RF) wireless technology (e.g., IEEE 802.11, Bluetooth, Zigbee), the description should include information about the specific RF wireless technology and characteristics, the RF wireless technology’s use and functions (e.g., remote monitoring or control, software updates), the data to be transmitted including any alarms transmitted wirelessly, quality of service (QoS) needed, wireless security measures and protocols, and any limitations or restrictions relating to coexistence with other RF wireless technology and electromagnetic compatibility of the wireless technology. Please refer to the FDA’s guidance, Radio Frequency Wireless Technology in Medical Devices (http://www.fda.gov/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm07 7210.htm).
• If your infusion pump contains software, provide a detailed description of the software design, including key elements, such as: o A drug library or other dose error reduction mechanism; o A real time clock (RTC); o On-board memory; o Pump log; o Alarm handler; and o Watchdog timer.
• You should describe any communication between your device and a hospital information management system or another device.
• You should describe the user interface components of the pump, including keypads, control menus, data entry screens, displays, indicator lights, alarms, auditory and tactile feedback, infusion sets, cassettes, free-flow prevention mechanisms, tubing, latches, doors or other components or accessories of the physical pump that may be manipulated.
• You should describe how you will market the device (e.g., sterile, single use, multi-patient use, home use).
In addition to providing the descriptive information requested above, we recommend that you provide a table comparing your device to a legally marketed predicate device. This table should include the following:
• The indications for use for each device, including the patient population for which the devices are intended (i.e., neonate, infant, pediatric, adult) and the intended use environment.
• The specifications for the devices, including but not limited to, flow accuracy specifications, time to occlusion alarm, dimensions, weight, ingress protection, power, and units of delivery. 8
• The technological features of the devices.
You should describe how any differences in technology may affect the comparative safety and performance of your device.
5. Safety Assurance Case Infusion pump 510(k) submissions typically include changes or modifications to software, materials, design, performance, or other features compared to the predicate. Accordingly, FDA expects that most new devices (as well as most changed or modified devices5) will have differences in technological characteristics from the legally marketed predicate device even if sharing the same intended use. Under section 513(i) of the Federal Food, Drug, and Cosmetic Act (the FD&C Act), determinations of substantial equivalence will rely on whether the information submitted, including appropriate clinical or scientific data, demonstrate that the new or modified device is as safe and effective as the legally marketed predicate device and does not raise different questions of safety and effectiveness in comparison to the predicate device.
In determining whether your new, changed, or modified infusion pump is substantially equivalent, FDA recommends that you submit your information through a framework known as a safety assurance case.6
The safety assurance case (or safety case) consists of a structured argument, supported by a body of valid scientific evidence that provides an organized case that the infusion pump adequately addresses hazards associated with its intended use within its environment of use. The argument should be commensurate with the potential risk posed by the infusion pump, the complexity of the infusion pump, and the familiarity with the identified risks and mitigation measures.
5 Based on FDA’s analysis of these devices, FDA expects that most changes or modifications to infusion pumps could significantly affect the safety or effectiveness of the devices and would therefore require submission of a new 510(k). See 21 CFR 807.81(a)(3). Note that a change to the intended use or technology of a 510(k)-cleared device may render the device not substantially equivalent (NSE) to a legally marketed predicate. For detailed information about substantial equivalence and 510(k) submissions, refer to the FDA guidance entitled, The 510(k) Program: Evaluating Substantial Equivalence in Premarket Notifications [510(k)] (http://www.fda.gov/downloads/MedicalDevices/.../UCM284443.pdf). Any such device may thus be a class III device and require a premarket approval application (PMA), unless the device is reclassified under section 513 of the Federal Food, Drug, and Cosmetic Act. 6 For more information about assurance case reports, see, for example: Graydon, P., J. Knight, and E. Strunk, “Assurance Based Development of Critical Systems,” Proc. of 37th Annual International Conference on Dependable Systems and Networks, Edinburgh, U.K., 2007; Kelly, T., Arguing Safety — A Systematic Approach to Managing Safety Cases, Ph.D. Dissertation, University of York, U.K., 1998; Kelly, T., “Reviewing Assurance Arguments - A Step-by-Step Approach,” Proc. of Workshop on Assurance Cases for Security - The Metrics Challenge, Dependable Systems and Networks, July 2007; Kelly, Tim, and J. McDermid, “Safety Case Patterns – Reusing Successful Arguments,” Proc. of IEE Colloquium on Understanding Patterns and Their Application to System Engineering, London, Apr. 1998; Weinstock, Charles B. and Goodenough, John B., “Towards an Assurance Case Practice for Medical Devices,” Carnegie Mellon Software Engineering Institute, October 2009; Hawkins, Richard, et. al., A New Approach to Creating Clear Safety Arguments, Safety-critical Systems Symposium, Southampton, UK, February 2011; UK Ministry of Defence, Defence Standard 00-56, Safety Management Requirements for Defence Systems – Part 1 and Part 2, June 2007.
9
Safety cases are device specific and depend on manufacturer-specified design requirements,7 associated hazards, design specifications, and other design control documentation. For this reason, any newly developed device should have its own unique safety case. If you are submitting a 510(k) for modifications to a legally marketed infusion pump for which no safety case exists, you should develop and submit a safety case for your infusion pump.
Safety assurance cases are best developed in parallel with the development of the device. Constructing your safety case in concert with the device will not only allow for better safety controls, claims, arguments, and evidence, it may reduce the costs of retrospective mitigations if it is determined that a finished design is not adequately safe.
You are encouraged to use previously developed high-level safety case structures, or patterns, for infusion pumps. Past safety assurance cases are useful as examples and may provide a basis for a development framework. However, you should ensure that any previous cases used are applicable to the system being developed.
To maximize the benefit of the safety case, you should maintain and refine your safety case throughout the life of the infusion pump. During development, maintenance, and refinement of your safety case, you should address the full lifecycle of the infusion pump within your safety case.
FDA is not prescribing the formatting or presentation style used to develop your safety case. The recommendations contained in this guidance document are intended to provide assistance and facilitate the development and documentation of the safety case.
Section 5A provides guidance on the development of the safety case and Section 5B – Section 5F provide guidance on elements that will make up the content of the safety case.
A. General Considerations for Safety Case Development
The three main elements of a safety assurance case are:
1. Claim: Statement about a property of the system or some subsystem.
2. Argument: Links the evidence to the claim. Arguments can be deterministic, probabilistic, or qualitative. The argument describes what is being proved or established, identify the items of evidence you are appealing to, and the reasoning (inference, rationale) that the evidence is adequate to satisfy the claim. Arguments may also introduce sub-claims or assumptions which require further exposition. In addition to demonstrating that the evidence is adequate to satisfy the claim, the argument should also address the confidence in the sufficiency of the evidence.
7 Throughout this guidance document, the term “design requirement” is used consistent with 21 CFR Part 820 Subpart C.
10
3. Evidence: Information that demonstrates the validity of the argument. This can include facts (e.g., based on observations or established scientific principles), analysis, research conclusions, test data, and expert opinions.
These elements of a safety case provide an argument that hazards caused by the device have been adequately addressed. This is accomplished through a thorough analysis of hazards and implementation of adequate controls to address the hazards.
Within a single safety case, there will be multiple layers of claims and arguments, with increasing levels of specificity as the safety case approaches the evidence level. Your safety case should make a claim about the safety of your infusion pump. The safety case for a specific infusion pump should incorporate the following:
• The persons for whose use the device is represented or intended; and • The conditions of use for the device, including conditions of use prescribed, recommended, or suggested in the labeling or advertising of the device, and other intended conditions of use.
The safety case should then progress to establishing that causes of the device hazards are adequately addressed within its context of use and demonstrate through evidence the effective implementation of the hazard mitigations.
The following recommendations are based on our experience reviewing safety cases.
• A separate argument structure demonstrating the completeness of the hazard analysis process, including techniques, procedures and results to assure that hazards present within the safety case are accurate and complete. This concept is often referred to as a confidence case.
• Depending on the complexity of the infusion pump, it is useful to provide specific argument structures for certain domains, such as software, human factors and reliability.
• Arguments should include justification for the selection of acceptability criteria for safety controls. These can be integrated into the safety case directly.
• A traceability analysis is useful in demonstrating that all identified hazardous situations have at least one corresponding control and that all controls have been verified and validated in the final device design.
• There are commonly used safety case formats. If you elect to submit a safety case using your own format, we recommend that you provide an executive summary to assist the FDA in navigating your safety case.
• FDA review of safety cases includes the use of postmarket data to confirm the validity of safety case arguments. You may find it useful to conduct a similar exercise during your own internal review.
11
• Manufacturers have benefited from early interaction with FDA on development of their safety case. FDA feedback may be obtained through the pre-submission process. Please refer to the FDA’s guidance, Requests for Feedback on Medical Device Submissions: The Pre-Submission Program and Meetings with FDA Staff Guidance (http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/Guidanc eDocuments/UCM311176.pdf).
B. Hazard Analysis The objective of the hazard analysis is to identify hazards and potential causes of the hazards. Specifically, the objective is to identify circumstances in which users or patients are exposed to a potential source of harm.
FDA has identified infusion pump system hazards, as shown in Table 2. Your safety case should provide an argument demonstrating that causes of these system hazards have been adequately addressed for your device.
Table 2 – Infusion Pump System Hazards
Infusion Pump System Hazards System Hazard Definitions Infusion Delivery Error Intended medication selected and delivery attempted, but failure to deliver within the right time, dose, volume, patient, or anatomical or physiologic site specifications. This can include over-delivery, under-delivery or delay in delivery situations. Incorrect Therapy Failure to select or deliver the intended medication because the wrong substance was selected for delivery. Biological/Chemical Contamination Unintended contact with biological or chemical substance, or unintended patient or provider physiologic response to intended biological or chemical substance. Traumatic Injury Burns, cuts, abrasions, air embolisms, electric shock, etc.
In developing your safety case, you should provide a hazard analysis for your infusion pump to identify the causes of the system hazards. All hazards should be evaluated within the context of the persons for whose use the device is represented or intended and the conditions of use for the device, including conditions of use prescribed, recommended, or suggested in the labeling or advertising of the device, and other intended conditions of use.
When identifying hazards, you should consider hazards occurring from the following:
• Systematic and random failures; • Failures due to normal or abnormal use during operational use, including sequences of use resulting in failure; • Predictable misuse; • Common cause failures; • Failures caused by system, sub-system, or component interactions; • Operating environment; • Energy sources (e.g., mechanical, electrical, magnetic, thermal); 12
• Exposure to chemical or biological substances; • Intentional and unintentional security breaches; • Human factors; • Storage and transport; and • Maintenance.
In addition to utilization of hazard analysis techniques, such as those identified in ISO 14971 (e.g., fault tree analysis, preliminary hazards analysis, hazards and operability studies, hazard analysis and critical control point, failure modes and effects analysis), you should consider information available to you on similar infusion pumps as part of your hazard analysis, including published literature, customer complaints, Medical Device Reports (MDR), recall databases, user feedback, and other relevant sources.
In Tables 3-10, FDA has provided examples of hazards and causes that may result in the occurrence of a hazardous situation. The purpose of FDA identifying specific hazardous situations and their causes is to provide an example framework for how to conduct your own analysis. You should conduct a thorough analysis for your infusion pump to identify any additional hazardous situations for your device and the foreseeable sequences of events that may result in any of the hazardous situations. Individual pump designs, environmental conditions, and conditions of use for the device will dictate what hazards should be identified and mitigated.
FDA recommends that the hazard analysis include a process for identifying initiating events and sequences of events for each hazardous situation throughout all aspects of device use (e.g., drug loading, priming, programming, infusion).
Sources of hazardous situations: • Operational (Table 3) • Environmental (Table 4) • Electrical (Table 5) • Hardware (Table 6) • Software (Table 7) • Mechanical (Table 8) • Biological and Chemical (Table 9) • Use (Table 10)
Table 3 – Operational Sources Hazard Potential Causes Air in Infusion Line Incorrect/incomplete priming processes Broken, loose, or unsealed delivery path The pump is unable to release gas or air The pump is set up with an incompatible infusion set Occlusion Delivery path obstructed, e.g., kinked tubes Chemical precipitation inside the delivery path Bolus occurring after an occlusion Uncontrolled Flow of Infusate (e.g. Valves in the delivery path are broken free flow) The pump is positioned much higher than the infusion site, causing unintentional drug flow The delivery path is damaged, creating a vent on the path that allows unintentional gravity flow Retrograde Flow of Infusate (e.g. The pump is positioned much lower than the infusion
13
Reverse Flow) site, causing the pump to siphon The delivery path is damaged, creating a vent on the path that diverts an intentional drug flow from reaching the user Excessive bolus administration due The bolus history records are corrupted, making the user to too many bolus requests from unable to track previously received boluses the user The programmed bolus dose is Algorithmic errors delivered unevenly over its The pump motor does not operate as intended specified duration Infusate Leakage Loose connection between parts of the delivery path
Broken drug reservoir The actual flow rate does not Air pressure within the pump is much lower than the match the programmed infusion ambient air pressure rate Pumping mechanism out of calibration The drug reservoir is detached The drug reservoir compartment is broken or opened during normal pump use
Table 4 – Environmental Sources Hazard Potential Causes Failure to operate / Pump Temperature / Humidity / Air pressure too high or too malfunction low The pump is exposed to pathogens, Contamination due to spillage / exposure to toxins allergens, or other hazardous Battery leak substances Disruption/malfunction of pump Electromagnetic interference (EMI) related to: due to electromagnetic interference - Radiofrequency (RF) emitters, e.g., mobile radios, (EMI) cellular telephone - Electrostatic discharge (ESD) - Conducted RF, e.g., via power line - Poor AC power quality, e.g., voltage surges or sags. Magnetic fields: e.g., electric motors, power lines
Inadequate shielding, filtering, or other electromagnetic compatibility (EMC) design or mitigation
Table 5 – Electrical Sources Hazard Potential Causes Overheating Incorrect or loose interconnections between devices Supply processor charge too high Insufficient cooling/faulty heat sink
Charge Error Battery could not be charged AC supply exceeds limits Battery voltage exceeds limits Supply Voltage Error Battery depleted Voltage conversion failed Battery Failure Battery voltage too low Battery depleted Battery overcharged Leakage Current too high Inadequate shielding
14
Short circuit Circuit failure Short circuit High impedance Low impedance Electrically conductive, corrosive fluid ingress
Electromagnetic compatibility Electromagnetic interference (EMI) [** see list in table 4]
Table 6 – Hardware Sources Hazard Potential Causes System failure Malfunctioning component Synchronization error between pump components Watchdog failure Reliability specification not met Network error Network congestion Communication problem Loss of (wireless) signal Pump not compatible with networked / integrated device Memory failure Attempted write to memory failed Critical value data integrity error False watchdog interrupt False alarm Device or sensor contaminated Device or sensor out of calibration Failure to alarm Sensor failure Incorrect dose value entered Key de-bounce prevention failed
Table 7 – Software Sources Hazard Potential Causes Data error Failure to backup Data store/retrieval error Communication problem Software runtime error Buffer overflow/underflow Null pointer dereference Memory leak Uninitialized variable Incorrect dynamic libraries System malfunction Software runtime error Communication error Corrupted infusion commands Data store/retrieval error Communication problem Pump could not be silenced Alarm priority set incorrectly Incorrect software version Software updates not installed Incorrect drug library loaded Incorrect version installed Failure to alarm / False alarm Sensor failure Alarm priority set incorrectly Incorrect settings of alarm thresholds
Table 8 – Mechanical Sources Hazard Potential Causes Unable to set dose, start/ stop/ reset Broken part (e.g., broken keypad) pump, silence alarm Incorrect dose value entered Key stuck / depressed 15
Failure to alarm Speaker / Audio unit failure Stress from various sources: random impacts (e.g., dropped device), vibration, shear, fatigue, rupture, fracture, wear, and temperature or force induced Physical Damage to pump deformation Fluid ingress Damage to power cord
Pump stops infusion Pump motor fails Pump unable to stroke
Table 9 – Biological and Chemical Sources Hazard Potential Causes The pump is exposed to pathogens, Inadequate device cleaning allergens, or other infectious Device contaminated by blood/leaking fluid substances Failure to flush The pump is connected to non-sterile infusion sets or reservoir Packaging of the pump is damaged prior to its use Infusion site infection The user is local skin reaction to the infusion set or infusion set adhesive The user fails to rotate infusion sites Chemical precipitation inside the Inadequate device cleaning delivery path Drug not compatible with device materials
Physical damage to pump Inadequate device cleaning or disinfection Damage to device materials from adsorption of the drug Loss of drug potency Adsorption of drug to device materials due to incompatible device materials Temperatures exceeds drug specifications Toxicity Materials of construction are not biocompatible Drug leaches chemicals from device Presence of natural rubber latex
Table 10 – Use Sources Hazard Potential Causes User does not understand how to User interface design is confusing initiate pump operation User is confused by pump operation Note: Can apply to lay users particularly The instructions for use are insufficient or lacking The training was insufficient or lacking
The pump is programmed Secondary infusion not properly initiated by the user incorrectly The instructions for use are confusing for the user The user enters incorrect configuration parameters (e.g., blood glucose reading, drug concentration) The user accidentally touches the pump console, presses the wrong key, or double-strikes a key, changing or erroneously programming pump settings Infusion stopped prematurely The user forgets to resume the pump after pausing it User is unaware of battery capacity and does not notice its low status The user fails to detect or Background noise or nuisance alarms cause user to fail to understand pump notifications detect or to ignore them
16
The user muffles the pump’s speaker or other audio output, either intentionally or unintentionally Wrong medication or User sets up pump with incorrect medication or incorrect concentration is delivered concentration Medication is correct but user enters into pump the incorrect concentration or delivery rate Physical set up, such as routing of User believes infusion is occurring but it is not tubing or selection of appropriate User is required to perform programming task sequences tubing set is incorrect beyond user expectations or capabilities User is confused about pump set-up, troubleshooting, or operation tasks Physical set-up of pump components is challenging for the user User “works around” or Software configuration, possibly user-defined “bypasses” software limits on configuration, is not applicable to current treatment and drug/dose parameters. user is compelled to “work around” or “bypass” it “Work around” or “bypass” requirements are required so often the user does not attend to displayed limits User ignores or misinterprets Warnings are displayed so often that user ignores them software-generated “warnings” Warning statements are not sufficiently informative, meaningful or appropriate for the condition and user does not understand how to respond User misinterprets or Pump operates differently than expected misunderstands pump status or Pump operational mode indications are absent or not operational mode communicated effectively Display characters not distinguishable and user cannot read them correctly or at all The pump is disconnected The user’s actions cause the pump to be disconnected accidentally from the patient or the power supply Children, pets, pests or vermin tamper with or damage pump components Excessive bolus administration due The user forgets previously received boluses or does not to too many bolus requests from wait long enough for previous bolus to take full effect the user (Drug) Leakage The user disconnects the pump incorrectly
Children, pets, pests or vermin tamper with or damage pump components The drug reservoir is detached The user’s actions cause the reservoir to be disconnected during normal pump use Tampering (for example, by a Unauthorized tampering of pump settings patient during home use to adjust drug delivery) Panel/door opened during infusion Infusion started when door open
C. Performance Testing Performance testing to verify/validate the pump design should assure that the related safety case claims are satisfied. This includes specific attention to statistical elements (hypotheses, analyses, sample size and sampling, power), controls, minimization of bias, test parameters (endpoints), follow-up, and evaluation criteria.
This performance testing should be conducted with the complete infusion pump system intended to be used with your device. Each available configuration of the system should be verified and
17
validated. If representative configurations are used for verification or validation activities, you should describe how the collected data are relevant to configurations that have not been subject to the verification or validation activities.
The amount and type of evidence required to support the indications for use and technology for a particular infusion pump varies. You should identify all of the evidence that you rely on to support your claims of safety and effectiveness and to provide confidence that the evidence selected is complete.
The premarket notification (510(k)) should include the following information for all design verification performance testing activities submitted in support of your safety case:
1. A description of the device design requirement being verified, including why it is essential to the proper functioning of the device;
2. A description of the unit under test and how it relates to the final, finished device;
3. The justification for the use of prototype or “production equivalent” devices or components during the design verification activity, if applicable;
4. An explicit statement of the acceptance criteria for the verification activity;
5. A detailed description of the verification method, including drawings and descriptions of the test apparatus where appropriate;
6. An explanation of how the verification test set up simulates actual clinical use conditions, if applicable;
7. The results of the verification activity;
8. An analysis of the verification activity results; and
9. An explicit statement of any conclusions drawn from the verification activity.
The premarket notification should characterize the user population(s), use environment(s), and include the following information for all design validation performance testing activities:
1. A description of the design requirement implemented to address a user need or intended use, which is being validated;
2. A description of the unit used during the design validation activity and how it relates to the final, finished product;
3. The justification for the use of prototype or “production equivalent” devices during the design validation activity, if applicable;
4. A detailed explanation of how the validation activity simulates actual clinical and/or home use (or a description of the actual use conditions);
18
5. An explicit statement of the acceptance criteria for the validation activity;
6. The design validation method/protocol used;
7. The results of the design validation activity;
8. An analysis of the design validation activity results; and
9. An explicit statement of any conclusions drawn from the design validation activity.
Use of Standards We encourage you to take advantage of any FDA-recognized standards and provide statements or declarations of conformity, as described in the FDA’s guidance, Use of Standards in Substantial Equivalence Determinations (http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/uc m073752.htm).8
References to standards within this guidance document do not mean that the standards must be complied with, or that they necessarily apply to your specific device. Your safety assurance case should address the appropriateness of any standard to support clearance of your infusion pump.
The safety case does not have to follow a prescribed or singular format. Similarly, ISO 14971 states that the risk management file can be in any format. Therefore, we encourage you to leverage your existing risk management activities to avoid duplication in the development and documentation of your safety case.
Operational Safety Infusion Delivery Accuracy Infusion delivery accuracy specifications should be appropriate for the intended use of the device and the testing should reflect the conditions of use for the device. The safety case should include an argument for how the infusion delivery accuracy specifications are appropriate within the context of the indications for use, including the therapeutic range of the fluids intended to be infused by the system, where specific fluids are indicated. When developing and verifying the accuracy specifications, you should consider the flow rates and duration of time over which the accuracy specification is defined.
Each available configuration of the system should be tested, though testing of representative configurations may also be acceptable. Where representative tests are provided, you should describe how the collected data are relevant to the untested configurations. In determining if a configuration is representative, you should identify the characteristics of your device that could affect the infusion delivery accuracy. Some examples of characteristics that should be considered include:
• Infusion sets: Length, diameter, number and type of flow restriction devices on the set, number and relative location of access points.
8 For more information on FDA recognized consensus standards, see www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfStandards/search.cfm.
19
• Drug reservoir: Size, position relative to pump. • Pump model/configurations: Flow rate limits, volume limits.
For a pump intended to maintain a constant set flow rate per your specifications, the data should demonstrate that the device can maintain a set flow rate over the complete course of the infusion within the designated accuracy. The testing should demonstrate adherence to specifications at the limits of the operational parameters.
For a pump that does not maintain a constant flow rate, test results should be used to generate a representative flow profile. This representative flow profile should be included in the device labeling. Testing should include an assessment of infusion delivery accuracy at the minimum, intermediate, and maximum flow rates. You should provide a justification for choice of intermediate flow rate.
For pumps that are capable of bolus delivery, test results should demonstrate that the accuracy of the bolus delivery is within specification. Testing should be representative of how bolus delivery will occur in use and should include an assessment of bolus accuracy at the minimum and maximum bolus dose.
Testing should also demonstrate that the device can maintain the specified flow characteristics despite changes in ambient temperature, fluid temperature, pressure (e.g., head-height, backpressure, atmospheric pressure), or fluid viscosity, which would reasonably be expected to be encountered according to the intended use of the device. The effects of these factors should be discussed quantitatively in the labeling so that the user is made aware.
Reliability Analysis Reliability includes component and system level analyses. You should provide an analysis of your infusion pump system reliability. The analysis should include a description of your system’s reliability specification and the reliability activities completed to verify and validate that the specification has been met (e.g., design analysis, test plans, and test reports). As part of the safety assurance case, the analyses and associated activities may take the form of claims, arguments, or evidence.
Environmental Safety Applicable Standards We recommend that your device meet the applicable environmental safety standards. In your 510(k) submission, you should present data or documentation demonstrating that your device meets the applicable safety standards. For the electromagnetic compatibility (EMC) aspects of environmental safety, see below.
General Considerations The environmental standards that you use for your particular infusion pump should be appropriate for the environments of intended use. For example, environmental hazards for a home use pump might be different from the hazards for a pump intended for use in a healthcare facility. For this reason, we recommend that you comprehensively characterize the range of potential environmental hazards for your infusion pump and establish appropriate strategies to control the hazards.
20
Your safety assurance case should identify and mitigate environmental hazards. You should characterize the use environment and establish the measures to support the use of your infusion pump within its environment.
Electrical Equipment Safety Applicable Standards We recommend that your device meet the applicable standards in ANSI/AAMI ES60601- 1:2012, entitled “Medical electrical equipment – Part I: General requirements for basic safety and essential performance.” In your 510(k) submission, you should present data or documentation demonstrating that your device meets the applicable standards. We recommend that mains-powered devices intended for home use should safely function without a protective earth ground as defined in ANSI/AAMI ES60601-1:2012, definition 3.14, class II. See also the FDA’s guidance, Design Considerations for Devices Intended for Home Use (http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/Guidanc eDocuments/UCM331681.pdf).
Electromagnetic Compatibility If your infusion pump contains any electrical components, you should include in your 510(k) submission information demonstrating the EMC of the device in its intended use environments. EMC is the ability of a device to operate properly in its intended environment of use (immunity) without introducing harmful electromagnetic disturbances into that environment (emissions). We recommend that your infusion pump be designed and tested for EMC in reference to IEC 60601-1-2:2014, entitled “Medical electrical equipment – General requirements for basic safety and essential performance – Collateral standard: Electromagnetic disturbances – Requirements and tests,”9 or the IEC 60601-1- 2:2007, entitled “Medical electrical equipment – General requirements for basic safety and essential performance – collateral standard: Electromagnetic Compatibility – Requirements and tests.”10 Alternatively the ANSI/AAMI/IEC versions of these standards can be referenced. In addition to evidence of conformity with one of these applicable standards, you should provide summary information in your premarket submission to FDA describing the following: • the testing that was performed and how this was done; • the device functions and modes that were tested; • the device specific pass/fail criteria used, including the performance that was determined to be Essential Performance; • reference standards and any deviations or allowances that were taken; • any device modifications needed to pass the testing; and • appropriate labeling.
Device manufacturers should consider appropriate levels of testing in accordance with the risks present in the intended use environments. Depending upon the use environment, the
9 FDA’s recognition of the 2014 version of the IEC 60601-1-2 is available at http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfStandards/detail.cfm?standard__identification_no=32631. Please note that the 2014 version of the IEC 60601-1-2 standard includes a transition period through April 2, 2017 as noted in FDA’s recognition. 10 FDA’s recognition of the 2007 version of the IEC 60601-1-2 is available at http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfStandards/detail.cfm?standard__identification_no=32628.
21
immunity test levels might need to be raised, particularly if the testing is performed in reference to the general immunity testing specified in the IEC and ANSI/AAMI/IEC 60601-1-2:2007 standard.11
You should also assess the EMC of your device with common sources of disturbance to electrically powered medical devices that could be in the use location(s) and might interfere with the performance of the medical device. These sources can include large electric motors, nearby radio and TV transmitters, radar, anti-theft systems (including tag deactivators), stereo speakers, and radio frequency identification (RFID).
Radio Frequency Wireless Technology If your submission includes radio frequency (RF) technologies, you should include in your 510(k) submission a complete description of the RF use. Even when applications of RF wireless technologies comply with applicable technology standards and Federal Communications Commission rules, medical device safety and effectiveness concerns can exist. For detailed information about possible hazards, refer to the FDA guidance on radio-frequency wireless technology, Radio-Frequency Wireless Technology in Medical Devices (http://www.fda.gov/medicaldevices/deviceregulationandguidance/guidancedocuments/uc m077210.htm). Particular points you should address in your 510(k) include quality of service needed, data integrity, coexistence, security, and EMC. Due to the increased use of RF wireless technology that operates in the same frequency range, you should address RF wireless coexistence via testing with other common applications of RF wireless technology that can be expected to be used in the environment of use. The testing should also address the ability of two or more of your infusion devices to operate wirelessly in proximity.
Hardware Safety Applicable Standards We recommend that your device meet the hardware safety standards of IEC 60601-1. In your 510(k) submission, you should present data or documentation demonstrating that your device meets the hardware safety standards.
Software Safety Applicable FDA Guidances and Standards Please refer to the FDA’s Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices (http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocument s/ucm089543.htm), for a discussion of the software documentation that you should provide in the 510(k) submission. We generally consider infusion pumps to be a “Major” level of concern for the purposes of software review.
If the device includes off-the-shelf software, you should provide the additional information as recommended in the FDA’s Guidance for Industry, FDA Reviewers and
11 Because the levels of electromagnetic disturbance in, for example, the home healthcare environment can exceed the default test levels for the hospital environment that are specified in IEC and ANSI/AAMI/IEC 60601-1-2:2007, if your device is specified for home use or use in transport, you should design your device to be immune to the disturbance levels that can be expected in these environments.
22
Compliance on Off-the-Shelf Software Use in Medical Devices (http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocument s/ucm073778.htm).
General Considerations You should provide a static analysis of all software in your infusion pump system.
When providing a list of unresolved anomalies, you should include the following information for each unresolved anomaly:
• A description of the anomaly from a symptom point of view and how it is manifested. • The location in the code where the anomaly occurs. • A description of how to fix the anomalous code. • A search of the software source code for other possible instances of the anomaly. For example, if the problem was an off-by-one error in an array, provide evidence that all arrays were checked for off-by-one errors. • Provide evidence that a coupling analysis was performed to identify all parts of the software that accessed the anomalous code and that no problems would arise because of accessing this anomalous code. • Provide an explanation for why the anomaly could not result in harm if it occurs. If justification is provided for not correcting the anomaly, you should provide any plans or timeframes for correcting the problem.
Information Security We recommend that you describe how your software addresses information security as it relates to safety and effectiveness. Information security is the process of preventing the modification, misuse or denial of use, or the unauthorized use of information that is stored, accessed or transferred from your device to an external recipient. We recommend that your 510(k) include documentation demonstrating that your device design addresses the following four components of information security described below: Confidentiality, Integrity, Availability, and Accountability (CIAA). Please refer to FDA’s guidance addressing cyber security in medical devices, Content of Premarket Submission for Management of Cybersecurity in Medical Devices (http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/Guid anceDocuments/UCM356190.pdf).
• Confidentiality means data, information, or system structures are accessible only to authorized persons, entities and processes at authorized times and in the authorized manner, thereby helping ensure data and system security. (The assurance that no unauthorized users have access to the information.)
• Integrity means data and information are accurate and complete and have not been improperly modified.
• Availability means data information and information systems are accessible and usable on a timely basis in the required manner. (The assurance that the information will be available when needed.)
23
• Accountability means an authorized user is identified and authenticated before access.
Network If your infusion pump is physically or wirelessly networked (e.g., hospital information system) you should include information in your 510(k) describing the purpose of allowing networked access to your infusion pump. Within your safety case, you should identify how the networked connection / capability could cause the manifestation of an infusion pump system hazard (e.g. infusion delivery error, incorrect therapy, contamination, or traumatic injury) and provide the supporting argument for how these are adequately addressed.
Dosing Algorithms For infusion pumps that contain algorithms intended to provide dosing recommendations, we recommend that you include the following information in your 510(k) submission:
• The dosing algorithms used within your device.
• For each algorithm identified, you should include the algorithm in symbolic form, define all parameters in each algorithm and identify what parameters can be modified by the end-user.
• For each algorithm identified, you should include clinical data or other justification (e.g., via scientific literature) for why you believe your algorithm is appropriate for your intended patient population.
• Each algorithm should be verified and validated in your software documentation to show that the calculations made by the dose calculator are correct and this data should be included in your submission.
Mechanical Safety Applicable Standards We recommend that your device meet the mechanical safety standards of IEC 60601-1.
General Considerations You should consider sources of mechanical forces that may be exerted on the infusion pump or that the infusion pump may exert on other objects that could result in a hazardous situation. The evidence that you provide should demonstrate that the sources of the mechanical hazards are controlled and that the controls are effective.
Biological Safety Biocompatibility Applicable FDA Guidance For information regarding biocompatibility, see Use of International Standard ISO-10993, 'Biological Evaluation of Medical Devices Part 1: Evaluation and Testing' (Replaces #G87-1 #8294) (blue book memo)
24
(http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocument s/ucm080735.htm).12
Your infusion pump might be made of materials that have been well characterized chemically and physically in the published literature and have a long history of safe use. We recommend that if you consider the tests suggested in the referenced biocompatibility guidance document or material characterization testing discussed below to not be applicable or appropriate, you should provide adequate justification for omission of these tests. In such situations, FDA recommends documenting the use of a particular material in a legally marketed predicate device or a legally marketed device with comparable patient exposure in order to support omission of the recommended tests.
To make a biological safety argument based on equivalence to a predicate, you should demonstrate that the route(s) of administration, materials of construction / processing and post manufacturing residuals are the same as the referenced predicate device intended for similar intended use and population.
General Considerations Infusion pumps include components that contact the patient or user. You should evaluate the biocompatibility of materials in the components that have direct or indirect contact with the patient or user, and report the results in your 510(k) submission.
You should provide a chemical and particulate characterization on the final, finished, fluid contacting device components demonstrating that risk of harm from device-related residues is reasonably low. For the assessment, we recommend the following:
• For device-related chemical residual characterization, the Agency recommends performing a leachables and extractables (L&E) study using representative solvents based on the spectrum of polarity for sample preparation as it may not be practical to use all fluids which may interact with the fluid contacting pump surface. Sample preparation for the L&E study should be based on the worst case scenario, i.e., exhaustive extraction conditions. Qualitative and quantitative estimation of device-related residuals is recommended using an applicable library of reference chemicals. A detailed study report showing sample preparation, analytical methods, a justification for specific solvents and extraction conditions used in chemical characterization, and a quantitative extraction profile would be recommended for device-related chemical residual evaluation. For the L&E study, we recommend that you consider ISO 10993-18 Biological evaluation of medical devices — Part 18: Chemical characterization of materials, 2005.
• For device-related particulate evaluation, you should follow current USP <788> Particulate Matter in Injections. FDA considers USP <788> to be limited to evaluation of micron particles.
12 FDA has issued draft guidance on use of ISO 10993 in testing medical devices for biocompatibility, Use of International Standard ISO 10993, Biological Evaluation of Medical Devices Part 1: Evaluation and Testing (http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM348890. pdf). When finalized, this guidance will represent FDA’s current thinking on this topic and will supersede the Blue Book Memorandum cited above.
25
• Device-related residual characterization alone may not provide appropriate information for risk of harm from device-related residues. The Agency recommends a comprehensive risk assessment of the device-related residuals based on route of exposure, toxicokinetics and toxicodynamics, and allowable limits in the intended population proposed for the new device.
Sterilization Applicable FDA Guidance You should provide the appropriate documentation recommended by the FDA’s, Updated 510(k) Sterility Review Guidance K90-1 (http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocument s/ucm072783.htm).
Reuse Infusion pumps and accessories intended for multiple patient reuse should include instructions for cleaning and disinfecting the device between uses in the device labeling. Also, where appropriate, consider specifying in your submission and labeling the number of times the device can be reused, with supporting information (see Shelf Life, below).
If cleaning or high-level disinfection of the device is recommended in the labeling, you should provide validation to demonstrate that such cleaning or high-level disinfection procedures are adequate. You should also demonstrate that after cleaning or high-level disinfection, the device continues to perform as intended.
Numerous infusion pumps are used in the home environment. If your pump is indicated for home use, you should specify in the labeling the types of cleaning agents/products that are readily available to the average home-based user along with instruction for cleaning the device. Validation of these procedures should be provided in your submission.
In order to demonstrate that your device meets the performance specifications after cleaning or disinfection, you should provide bench data before and after an appropriate number of cleaning or disinfection cycles per your labeling. FDA has developed draft guidance that discusses labeling a device with cleaning or disinfection methods, Processing/Reprocessing Medical Devices in Health Care Settings: Validation Methods and Labeling (http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocument s/ucm252999.htm). When finalized, this guidance will represent FDA’s current thinking on this topic.
Shelf Life If your particular infusion pump contains sterile components or materials that could degrade over time, we recommend that you include a shelf life on the packaging.
We recommend that you provide data to demonstrate that the sterility and performance of your particular infusion pump are maintained throughout any specified shelf life. If accelerated test methods are utilized, you should provide information validating that the test methods accurately simulate real-time conditions for your device. For additional information, please see the FDA’s guidance, Shelf Life of Medical Devices
26
(http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/Guidanc eDocuments/UCM081366.pdf).
Drug / Biological Product Stability and Compatibility If your infusion pump is indicated to deliver specific types of drugs or biological products, you should verify and validate that your infusion pump system does not adversely affect the drug or biological products being delivered by your infusion pump and that these products do not adversely affect your infusion pump system.13
As noted in the labeling recommendations of this document, you should identify the particular drugs or biological products that you have evaluated for use with your device.
Use Safety Applicable FDA Guidance and Standards For more information regarding use safety, see FDA’s guidance, Design Considerations for Devices Intended for Home Use (http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/Guidanc eDocuments/UCM331681.pdf).
In addition, FDA has issued draft guidance on this topic, Applying Human Factors and Usability Engineering to Optimize Medical Device Design (http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocument s/ucm259748.htm). When finalized, this guidance will represent FDA’s current thinking on this topic.
We encourage the use of the following standards, as recognized by FDA: • AAMI ANSI HE75 Design of Medical Devices; and • IEC 62366, Medical devices - Application of usability engineering to medical devices. (General).
General Considerations Reports of device-related incidents and recalls have shown that patterns of use errors resulting from flaws in the design of the pump’s user interface have led to patient harm. The term user interface denotes all components of the pump with which the user interacts, for example:
• Keypads and/or control mechanisms; • Feedback mechanisms (auditory alarms, visual alarms, indicators, and other messages to users); • Design of graphical user interface, including responses to user actions, such as auditory and visual feedback, and changes in pump operation or programming; and • Directions for use.
13 For additional information on drug or biological product stability, see FDA’s guidance documents on the CDER webpage (http://www.fda.gov/Drugs/GuidanceComplianceRegulatoryInformation/Guidances/ucm064979.htm) or CBER webpage (http://www.fda.gov/BiologicsBloodVaccines/GuidanceComplianceRegulatoryInformation/default.htm).
27
Use hazards associated with use of pumps are a unique form of hazard in that they can exist even when a pump operates in accordance with its specifications. These hazards generally do not involve failures due to faulty mechanical, electrical or software components that are previously known or reasonably anticipated, but rather, arise specifically from interaction with a human operator.
Additional considerations to address in your hazards analysis for human factor/usability issues should include:
• Operator (user) interface component features and operation including overall logic of operation (interaction between the user and the device components and user interfaces); • Arrangement of user interface components for users’ physical interactions with the device; • Potential errors associated with atypical user actions or technique; • Legibility of visual information, including device labels and displays; • Audibility of aural information, including different alarm tones; • Potential difficulties associated with each possible setting or input available to operators; • Potential errors associated with input, selection or modification of critical treatment parameters; • Potential errors associated with non-standard or unusual parameter settings or default values; • Data transfer and communication inaccuracies; • Potential confusion due to non-standard, unfamiliar or ambiguous conventions or abbreviations; and • Potential confusion due to non-standard, ambiguous, or inadequate alarm condition or information messages.
Human Factors Validation Study Report The submission should include a Human Factors Validation study report to confirm the design of the product-user interface. For additional information on human factors design optimization see the FDA’s Draft Guidance for Industry and Food and Drug Administration Staff - Applying Human Factors and Usability Engineering to Optimize Medical Device Design (http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocument s/ucm259748.htm).
Clinical Investigation The safety assurance case report should include evidence to demonstrate that the hazardous situation controls are effective. This may include an evaluation of the infusion pump under conditions of actual clinical use, in addition to the simulated use studies.
During development of your safety assurance case report, you should consider your device’s indications for use and technology. Appropriate evidence to validate the intended use of the device should be included in the safety case report. Where information does not exist to make sufficient safety arguments on the basis of simulated use studies alone (e.g.,
28
different technological characteristics as compared to the predicate device), FDA recommends clinical investigation of the device.
FDA has determined that an infusion pump is a significant risk device, as defined in 21 CFR 812.3(m), and as such, any clinical investigation must therefore be conducted under an approved investigational device exemption (IDE). 21 CFR 812.20(a). Sponsors of such studies must not begin their clinical investigations until FDA has approved the IDE application (21 CFR 812.20(a)(2) and 812.42), and the clinical investigation must comply with the following:
• IDE requirements, 21 CFR Part 812 (21 CFR 812.2(a));
• Institutional review board (IRB) requirements, 21 CFR Part 56 (21 CFR Part 812, Subpart D); and
• Informed consent requirements, 21 CFR Part 50 (21 CFR 812.100).
D. Labeling Premarket notifications must include proposed labels, labeling, and advertisements sufficient to describe the device, its intended use, and the directions for its use, as required by 21 CFR 807.87(e). Where applicable, photographs or drawings should be supplied. The following suggestions are aimed at assisting you in preparing labels and labeling that satisfy the requirements of 21 CFR Part 801.
We recommend that you provide clear instructions for use that delineate the technological features of the specific device and how to use the device.
We recommend instructions for use be evaluated by representative users to ensure that critical aspects of pump use and maintenance are clearly and completely communicated. The results should be part of your 510(k) submission.
Directions for Use As a prescription device, infusion pumps are not safe except under the supervision of a practitioner licensed by law to direct the use of such device and therefore must include certain information in the labeling for the practitioner to use the device safely and for the purpose for which it is intended, as required by 21 CFR 801.109. Labeling must include adequate information for the safe use of the device by health care professionals, including indications, effects, routes, methods, frequency and duration of administration, and any relevant hazards, contraindications, side effects and precautions, as required by 21 CFR 801.109.
In addition to the labeling requirements in 21 CFR 801.109, including the prescription statement required under 21 CFR 801.109(b)(1), FDA recommends that the labeling contain the following information:
• Indications for use, including:
o Identify the fluids or fluid types as supported by the submission; 29
o Use environment(s); o Route(s) of administration for infusion; o Indicate treatment population.
• Cleaning and disinfection instructions for reusable infusion pumps and accessories. If the pump is used in the home, please identify cleaning and disinfection agents available to the general public that are suitable for device reuse (cleaning and disinfection).
• Alarm limits and ranges.
• Default settings.
• A complete representation of the user interface, including detailed depiction of screens and data fields and how they will be used to accomplish all clinical applications and possible configurations of the pump.
• An identification of any dedicated administration set or the specifications and/or specific models of infusion sets that are appropriate for use with this pump.
• Identify reservoir volume, selectable flow rates and profiles, and residual fluid volume remaining after the infusion is complete.
• Describe any factors that may affect flow accuracy such as ambient temperature, fluid temperature, pressure (e.g., head-height, backpressure, atmospheric pressure), fluid viscosity, or changes in flow rate or bolus delivery (e.g., such as when titrating medications).
• Define the accuracy specifications over the range of selectable flow rates and bolus volumes. This may include information such as:
o Time period over which accuracy is specified; o Time to reach steady-state flow accuracy; and o Effect of infusion rate changes or bolus delivery on accuracy.
• Define the bolus delivery rate, if applicable.
• A description of the fluid(s) to be administered by the pump as indicated in the statement of intended use found in the labeling of the device, with a listing of tested products (e.g., blood products, enteral feedings and lipids, cytotoxic drugs or their characteristics). In the warnings or contraindications section, please list known fluid characteristics that are not compatible with the infusion pump.
• Comprehensive directions for preparation and use for all functions of the device.
• Describe a method or methods that can be used to confirm that the device is in calibration for all relevant delivery features.
• Description of all alarm or information messages and recommended actions when alarms or information messages are provided. 30
For infusion pumps containing a reservoir, container, or other components contacting the drug or biological product being infused, include information regarding the stability and compatibility of those fluids with your device.14
• All recommendations for infusion pump use regarding the fluids should be consistent with the FDA-approved labeling for the fluid products.
• Warning statements on your device regarding the safety of use during diagnostic procedures, such as magnetic resonance imaging (MRI), x-ray, computed tomography (CT), or ultrasound.
• Labeling should include all recommended information related to EMC, including reference to the appropriate standard, such as IEC 60601-1-2.
• For devices with RF wireless technology capabilities, the labeling should include information about the exact RF wireless technology incorporated or able to be used with your device. The information should contain specifics about the technology (e.g., IEEE 802.11 b), the frequency of operation and range, quality of service required for the claimed functions, data integrity, recommended security measures for the RF wireless technology (e.g., WPA2), coexistence and any limitations (e.g., distance between RF devices, EMC limitations).
• If the pump is designed to be used by individuals with specific disabilities, those disabilities should be described in the labeling.
Home Use Labeling We recommend all infusion pump labeling specify the environment in which the pump is intended to be used. Infusion pumps that are intended for home use should also include instructions for use suitable for the lay user, who is to receive the device from or on the order of a health care provider and use the device under the supervision of a licensed practitioner.15 These instructions for use should contain the information recommended in the “Directions for Use” section above. Home care pumps should include the device manufacturer’s toll free phone number for customer support on the device in the event the device labeling is misplaced or lost. See also the FDA’s guidance Design Considerations for Devices Intended for Home Use (http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceD ocuments/UCM331681.pdf).
14 See Section C. Performance Testing: Drug/Biological Product Stability and Compatibility. 15 As described elsewhere in the section “Directions for Use,” these infusion pumps are prescription devices under 21 CFR 801.109. See footnote 2 for a discussion of lay users.
31
E. Alarms In response to a hazardous situation, a pump may issue an alarm. Each alarm should be clearly indicated to the user. We recommend that your device meet the standards of IEC 60601-1-8: Medical electrical equipment – Part 1-8: General requirements for safety – Collateral standard: Alarm systems. Use of alarms as a hazard control mechanism should be justified in your safety assurance case. You should also address any risks of infusion delivery error associated with false positive alarms and false negative alarms.
An alarm may be triggered due to one or more hazards, including, but not limited to:
• Occlusion (supply side and patient side); • Air-in-line; • Free flow / Improper flow of fluid; • Depleted battery or No power; • Defective battery; • Low or Empty reservoir; • No reservoir; • Dose limit / Bolus limit exceeded; • Panel unlocked / door open; • Key pressed alarm; • Power on self test (POST) failure – issued when one of the POST tests fails; • ROM / RAM CRC test failure; • Tone test failure; • Pump mechanism failure; • Watchdog alarm – issued when the watchdog timer expires; • Overheating; • Drug library mismatch; and • Infusion set not loaded properly.
F. Safety Control Mechanisms An infusion pump may have safety control mechanisms to prevent or detect hazardous situations. These may include, but are not limited to:
1. Power on self test (POST) checks – performed during pump startup or initialization; 2. Battery test; 3. Stuck key test; 4. Tone test; 5. Pump mechanism failure test; 6. Watchdog interrupt tests; 7. (Periodic) System checks – including a CPU test and ROM / RAM CRC tests; 8. Air detection sensors 9. Environmental monitoring sensors 10. Sensor checks – to check the proper functioning of sensors attached to the pump, if any; and 11. Dose error reduction checks.
32
Correct implementation of any safety control mechanism should be verified and validated.
Your safety case should also address hazardous situations initiated by the safety control mechanism itself.16 Analysis of safety control mechanisms should address and mitigate the following:
• The safety control mechanism action is not provided or followed; • The resulting action from a safety control mechanism is unsafe and results in a hazardous situation; • The safety control mechanism action occurs too early, too late, or in the wrong order. • The safety control mechanism action is stopped too soon or applied too long.
6. 510(k) Pre-Clearance Inspection of Infusion Pump Manufacturers FDA may conduct a pre-clearance inspection of infusion pump manufacturers.
Since 2003, FDA has seen a dramatic increase in the number of Class I recalls17 associated with infusion pumps. FDA has also received numerous MDRs and complaints from consumers associated with the use of infusion pumps. These recalls and MDRs suggest that infusion pump manufacturers may not have adequate quality system implementation at their manufacturing facility. Subsequent FDA inspections have often identified violations of the Quality System regulation in these situations. Thus, FDA finds that preclearance inspections may be necessary to reduce serious adverse events associated with the use of these devices.
In determining whether a pre-clearance inspection is needed, FDA may consider, among other factors, whether:
• It is a device that presents new technological characteristics;
• An inspection of the facility has not occurred within the past two years;
• An inspection has occurred within the past two years, but did not cover a similar manufacturing process and product;
• An inspection has occurred within two years and the classification was voluntary action indicated (VAI) or official action indicated (OAI); or
• A 510(k) is submitted to change the device to address failures or postmarket device malfunction reports.
16 Leveson, Nancy, Engineering a Safer World, Cambridge, MA, MIT Press, 2011. 17 Under 21 CFR 7.3(m)(1), a class I recall “is a situation in which there is a reasonable probability that the use of, or exposure to, a violative product will cause serious adverse health consequences or death.”
33
When a pre-clearance inspection is needed, FDA intends to perform a Level 2 Comprehensive Inspection per FDA’s Compliance Program Guidance Manual 7382.845, Inspection of Medical Device Manufacturers. This inspection will include review of your MDR procedures and processes.
FDA finds that there is a substantial likelihood that the failure to comply with the Quality System regulation (21 CFR Part 820) for these products will potentially present a serious risk to human health. Therefore, in accordance with section 513(f)(5) of the FD&C Act, FDA may withhold clearance of your 510(k) submission for infusion pumps covered by this guidance based on the results of a pre-clearance inspection.
7. Postmarket Surveillance of Infusion Pumps
Manufacturer Reporting Requirements
Infusion pump manufacturers are subject to the MDR regulations at 21 CFR Part 803. The MDR regulation (21 CFR 803.50) requires a manufacturer to submit a report to FDA whenever the manufacturer becomes aware of information, from any source, that reasonably suggests that its device:
• May have caused or contributed to a death or serious injury; or • Has malfunctioned and the device or a similar device that the manufacturer markets would be likely to cause or contribute to a death or serious injury if the malfunction were to recur.
The MDR regulations also include reporting and recordkeeping requirements for medical device user facilities (e.g., hospitals, nursing homes) and importers of medical devices, as well as device complaint recordkeeping requirements for medical device distributors.
Manufacturers (defined in 21 CFR 803.3) are required to comply with 21 CFR Part 803, which includes the following:
• Submit MDR reportable events involving their medical devices, as described in 21 CFR 803.50 and 803.52; • Submit 5-day reports, as described in 21 CFR 803.53; • Submit supplemental reports, as described in 21 CFR 803.56; • Develop, maintain, and implement written procedures for the timely and effective identification, communication, and evaluation of events that may be subject to MDR requirements, and for a standardized review process for determining when an event meets the criteria for reporting under 21 CFR Part 803, as required by 21 CFR 803.17; • Conduct an investigation of each event and evaluate the cause of the event, as required by 21 CFR 803.50(b)(3), and • Establish and maintain MDR event files, clearly identify all MDR event files, and maintain them to facilitate timely access, as required by 21 CFR 803.18.
34
The MDR report (FDA Form 3500A) must contain all the information described in 21 CFR 803.52 that is known or reasonably known to the manufacturer. Information reasonably known, under 21 CFR 803.50(b), includes any information that the manufacturer:
• Can obtain by contacting a user facility, importer, or other initial reporter; • Is in the possession of; or • Can obtain by analysis, testing, or other evaluation of the device.
The FDA Form 3500A, instructions for completing specific items on the form, and the coding manual can be found at: http://www.fda.gov/downloads/Safety/MedWatch/HowToReport/DownloadForms/UCM3870 02.pdf.
For additional guidance on the MDR regulations and the reporting requirements, please refer to the FDA’s Guidance, Medical Device Reporting for Manufacturers (http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/uc m094529.htm).
Common Infusion Pump Reportability Questions from Manufacturers
Do I need to submit an MDR report If the information reasonably suggests that your for malfunctions that result in delay of device may have caused or contributed to a death or drug therapy? serious injury, or has malfunctioned and that the device or a similar device marketed by you would be likely to cause or contribute to a death or serious injury if the malfunction were to recur, then this is considered a reportable event. 21 CFR 803.3 and 803.50. We have a fail-safe feature in our The fact that you have a fail-safe feature does not infusion pumps. Since we have this eliminate your obligations under 21 CFR part 803. feature in our pumps, when there is a You must develop, maintain, and implement device malfunction, would I have to written procedures for the timely and effective submit an MDR report? identification, communication, and evaluation of events that may be subject to MDR requirements, and for a standardized review process for determining when an event meets the criteria for reporting under 21 CFR Part 803, as required by 21 CFR 803.17.
35
It is important to analyze, test, and evaluate the How much effort should a firm take to device in order to conduct a thorough investigation obtain additional information and/or into the root cause of the reported event and the device? determine if device malfunction contributed to the event. 21 CFR 803.50(b).
If your report omits any required information, you must explain why this information was not provided and the steps taken to obtain this information. 21 CFR 803.52(f)(11)(iii). The MDR report (FDA Form 3500A) must contain How much detail do I need to use to all the information described in 21 CFR 803.52 that describe the event? is known or reasonably known to the manufacturer, including, but not limited to: how the device was involved, nature of the problem, any required patient treatment, outcomes attributed to the adverse event, and any environmental conditions that may have influenced the event. 21 CFR 803.52.
36